CVE-2025-68735

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-68735", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-24T10:30:51.028Z", "datePublished": "2025-12-24T12:09:34.364Z", "dateUpdated": "2026-10-21T12:38:25.918Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:38:25.918Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: Prevent potential UAF in group creation\n\nThis commit prevents the possibility of a use after free issue in the\nGROUP_CREATE ioctl function, which arose as pointer to the group is\naccessed in that ioctl function after storing it in the Xarray.\nA malicious userspace can second guess the handle of a group and try\nto call GROUP_DESTROY ioctl from another thread around the same time\nas GROUP_CREATE ioctl.\n\nTo prevent the use after free exploit, this commit uses a mark on an\nentry of group pool Xarray which is added just before returning from\nthe GROUP_CREATE ioctl function. The mark is checked for all ioctls\nthat specify the group handle and so userspace won't be abe to delete\na group that isn't marked yet.\n\nv2: Add R-bs and fixes tags"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The flaw is reached through concurrent GROUP_CREATE and GROUP_DESTROY ioctls on a Panthor DRM device node, making it locally exploitable.\nAC:L - The attacker controls both racing threads, handles are predictably allocated from a 1\u2013128 range, and attacker-controlled queue allocations widen the repeatable race window.\nPR:L - Both ioctls have DRM_RENDER_ALLOW, and low or medium group priorities require no capability; a basic unprivileged process with render-node access suffices.\nUI:N - The attacker directly issues the concurrent ioctls without requiring any action from another user.\nS:U - The corruption affects the host kernel within the same security authority and represents standard local privilege escalation, not a VM or IOMMU-boundary escape.\nC:H - The group can be freed and reclaimed while creation continues dereferencing stale pointers, providing exploitable heap corruption that can enable arbitrary kernel-memory disclosure.\nI:H - Post-free operations write queue pointers, counters, list links, locks, and task metadata into reclaimed memory, enabling arbitrary corruption and potential control-flow hijacking.\nA:H - Concurrent cleanup can free the group and associated resources while they remain in use, allowing repeatable kernel crashes, oopses, or panics."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/panthor/panthor_sched.c"], "versions": [{"version": "de85488138247d034eb3241840424a54d660926b", "lessThan": "c6bbec068a9accd6f1df05f3df9a5254c99292ee", "status": "affected", "versionType": "git"}, {"version": "de85488138247d034eb3241840424a54d660926b", "lessThan": "deb8b2491f6b9882ae02d7dc2651c7bf4f3b7e05", "status": "affected", "versionType": "git"}, {"version": "de85488138247d034eb3241840424a54d660926b", "lessThan": "c646ebff3fa571e7ea974235286fb9ed3edc260c", "status": "affected", "versionType": "git"}, {"version": "de85488138247d034eb3241840424a54d660926b", "lessThan": "eec7e23d848d2194dd8791fcd0f4a54d4378eecd", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/panthor/panthor_sched.c"], "versions": [{"version": "6.10", "status": "affected"}, {"version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.13", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.2", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.17.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.18.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c6bbec068a9accd6f1df05f3df9a5254c99292ee"}, {"url": "https://git.kernel.org/stable/c/deb8b2491f6b9882ae02d7dc2651c7bf4f3b7e05"}, {"url": "https://git.kernel.org/stable/c/c646ebff3fa571e7ea974235286fb9ed3edc260c"}, {"url": "https://git.kernel.org/stable/c/eec7e23d848d2194dd8791fcd0f4a54d4378eecd"}], "title": "drm/panthor: Prevent potential UAF in group creation", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/panthor/panthor_sched.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c6bbec068a9accd6f1df05f3df9a5254c99292ee", "status": "affected", "version": "de85488138247d034eb3241840424a54d660926b", "versionType": "git"}, {"lessThan": "deb8b2491f6b9882ae02d7dc2651c7bf4f3b7e05", "status": "affected", "version": "de85488138247d034eb3241840424a54d660926b", "versionType": "git"}, {"lessThan": "c646ebff3fa571e7ea974235286fb9ed3edc260c", "status": "affected", "version": "de85488138247d034eb3241840424a54d660926b", "versionType": "git"}, {"lessThan": "eec7e23d848d2194dd8791fcd0f4a54d4378eecd", "status": "affected", "version": "de85488138247d034eb3241840424a54d660926b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/panthor/panthor_sched.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.13", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: Prevent potential UAF in group creation\n\nThis commit prevents the possibility of a use after free issue in the\nGROUP_CREATE ioctl function, which arose as pointer to the group is\naccessed in that ioctl function after storing it in the Xarray.\nA malicious userspace can second guess the handle of a group and try\nto call GROUP_DESTROY ioctl from another thread around the same time\nas GROUP_CREATE ioctl.\n\nTo prevent the use after free exploit, this commit uses a mark on an\nentry of group pool Xarray which is added just before returning from\nthe GROUP_CREATE ioctl function. The mark is checked for all ioctls\nthat specify the group handle and so userspace won't be abe to delete\na group that isn't marked yet.\n\nv2: Add R-bs and fixes tags"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/panthor: Prevenir posible UAF en la creaci\u00f3n de grupos\n\nEste commit previene la posibilidad de un problema de uso despu\u00e9s de liberaci\u00f3n en la funci\u00f3n ioctl GROUP_CREATE, que surgi\u00f3 porque se accede al puntero al grupo en esa funci\u00f3n ioctl despu\u00e9s de almacenarlo en el Xarray. Un espacio de usuario malicioso puede adivinar el identificador de un grupo e intentar llamar a la ioctl GROUP_DESTROY desde otro hilo aproximadamente al mismo tiempo que la ioctl GROUP_CREATE.\n\nPara prevenir el exploit de uso despu\u00e9s de liberaci\u00f3n, este commit utiliza una marca en una entrada del Xarray del pool de grupos que se a\u00f1ade justo antes de regresar de la funci\u00f3n ioctl GROUP_CREATE. La marca se verifica para todas las ioctls que especifican el identificador del grupo y as\u00ed el espacio de usuario no podr\u00e1 eliminar un grupo que a\u00fan no est\u00e1 marcado.\n\nv2: A\u00f1adir las etiquetas R-bs y fixes"}], "id": "CVE-2025-68735", "lastModified": "2026-10-21T13:18:24.103", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2025-12-24T13:16:28.440", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c646ebff3fa571e7ea974235286fb9ed3edc260c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c6bbec068a9accd6f1df05f3df9a5254c99292ee"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/deb8b2491f6b9882ae02d7dc2651c7bf4f3b7e05"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eec7e23d848d2194dd8791fcd0f4a54d4378eecd"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: drm/panthor: Prevent potential UAF in group creation", "id": "2425067", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2425067"}, "csaw": false, "details": ["No description is available for this CVE."], "name": "CVE-2025-68735", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-68735\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-68735\nhttps://lore.kernel.org/linux-cve-announce/2025122410-CVE-2025-68735-dce5@gregkh/T"]}

{}